chore(deps,middleware)(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /middleware - #595
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.9.3 to 7.0.2. - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) --- updated-dependencies: - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
9 tasks
Weegy
added a commit
that referenced
this pull request
Aug 5, 2026
* chore(deps): consolidated dependency batch 2026-08-04 Supersedes 11 individual Dependabot PRs with one verified batch. npm (middleware): - @modelcontextprotocol/sdk 1.29.0 -> 1.30.0 (harness-orchestrator) - @aws-sdk/client-s3 3.1095.0 -> 3.1102.0 - @azure/msal-node 5.4.2 -> 5.4.3 - bonjour-service 1.4.3 -> 1.4.4 - jose 6.2.4 -> 6.2.8 npm (web-ui): - lucide-react 1.27.0 -> 1.28.0 - framer-motion 12.42.2 -> 12.43.0 - jsdom 29.1.1 -> 30.0.1 (major, dev) - @types/react 19.2.17 -> 19.2.18 - @types/react-dom 19.2.3 -> 19.2.4 - @vitejs/plugin-react 6.0.4 -> 6.0.5 docker: - node 22.23.1-slim -> 22.23.2-slim (Dockerfile, web-ui, dev-runner) - node 22.23.1-alpine -> 22.23.2-alpine (dev-runner-daemon) ci: - actions/download-artifact v7 -> v8 (major) aws-sdk and jose resolve one patch beyond the Dependabot proposals, which were cut a day earlier. Excluded, with reasons in the PR body: typescript 7.0.2 (#595, blocked by typescript-eslint peer range) and better-sqlite3 13.0.2 (#596, drops the prebuild-install hook so it compiles from source in a slim image that has no Python). * fix(deps): bump brace-expansion override to 5.0.9 (clears 15 high advisories) The `brace-expansion` override in both workspaces pinned 5.0.8, which a new advisory now flags as high: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (vulnerable: >=4.0.0 <5.0.9) Because the pin was exact, npm held the vulnerable version in place and `npm update` could not move it. Bumping the pin to 5.0.9 clears the whole cascade: web-ui went from 15 high advisories to 0 (the eslint / typescript-eslint tree was flagged only transitively through brace-expansion -> minimatch), and middleware from 4 to 1. This is not a regression from this branch — main is red on the same gate (run 30887391724). npm's audit registry endpoint recovered on 2026-08-04, so the workflow's "audit endpoint returned an error" bypass stopped firing and pre-existing advisories became blocking for the first time. The remaining middleware advisory is fast-uri 3.1.4 (<3.1.5, host confusion via backslash authority introducer), reached through ajv@8.20.0. Deliberately NOT fixed here: npm only re-applies a changed override during a full lockfile regeneration, and regenerating drags in 75 unrelated package changes including a @hono/node-server 1.19 -> 2.1 major. That belongs in its own reviewed PR, not a dependency batch. * fix(deps): pin fast-uri 3.1.5 to clear the last high advisory Closes the remaining `audit (high+critical block) (middleware)` failure: fast-uri: host confusion via backslash authority introducer (vulnerable: >=3.0.0 <3.1.5) Reached through ajv@8.20.0, which requires `fast-uri: ^3.0.1`. ajv is already at its latest release, so there is no upstream fix to take. The `overrides` entry is bumped to 3.1.5 and the single lockfile entry is moved to match. This is deliberately surgical: npm refuses to re-apply a changed override to an already-locked transitive dependency (`npm ls` prints `fast-uri@3.1.4 invalid: "3.1.5" ... overridden` and does nothing), and the only npm-native way to make it re-resolve -- deleting the lockfile and regenerating -- rewrites 75 unrelated package versions, including a @hono/node-server 1.19.17 -> 2.1.0 major and a hoisting change that splits ajv@8 into five per-workspace copies. None of that belongs in a dependency batch, so the lockfile is edited to exactly the entry a correct resolution would produce instead. The integrity hash is the registry's own for 3.1.5, and `npm ci` verifies it against the downloaded tarball, so the pin is not taken on trust. Verified: npm ci clean, `npm ls fast-uri` reports no invalid markers, build + lint + typecheck pass, 5502 tests pass / 0 fail, ajv relative $ref resolution (the code path that uses fast-uri) still resolves, and the audit gate exits 0.
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/middleware/typescript-7.0.2
branch
August 5, 2026 11:01
Weegy
added a commit
that referenced
this pull request
Aug 10, 2026
Consolidates the 2026-08-10 Dependabot run into one verified change, superseding #628, #629, #630, #631, #632, #633, #634, #635 and #636. middleware: @azure/msal-node 5.5.0, typescript-eslint 8.66.0, ws 8.21.3, @types/pg 8.21.0 (dev), tsx 4.23.12 (dev), csv-parse 7.0.2. web-ui: next 16.3.0, next-intl 4.13.5, framer-motion 13.0.0, lucide-react 1.31.0, eslint-config-next 16.3.0 (dev), @testing-library/user-event 14.6.3 (dev). ws, @types/pg, tsx and lucide-react take the current resolution rather than the bot's, which had already gone stale. framer-motion 13's only breaking change is the removal of automatic @emotion/is-prop-valid loading; that package is absent from the tree and MotionConfig/isValidProp appear nowhere in the repo, so the bump is inert. Also mirrors the typescript major-version ignore from the /web-ui dependabot block into /middleware, which lacked it and therefore re-raised a TypeScript 7 bump every Monday (see #595). Excludes #637 (better-sqlite3 13): v13 dropped its install hook and needs a Docker builder toolchain, which #615 already carries. Verified on Node 22.22.3 in CI job order: middleware 6094 pass / 0 fail, web-ui 657 pass / 0 fail, both lint 0 errors, typecheck clean, web-ui build and i18n:check pass, and npm audit reports 0 high / 0 critical in both workspaces.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps typescript from 5.9.3 to 7.0.2.
Release notes
Sourced from typescript's releases.
Commits
Maintainer changes
This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.